## Simple top-like I/O monitor
########################################
##
## Execute TEMPLATE in the iotop domin.
##
##
##
## Domain allowed to transition.
##
##
#
interface(`iotop_domtrans',`
gen_require(`
type iotop_t, iotop_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, iotop_exec_t, iotop_t)
')
########################################
##
## Execute iotop in the iotop domain, and
## allow the specified role the iotop domain.
##
##
##
## Domain allowed to transition
##
##
##
##
## The role to be allowed the iotop domain.
##
##
#
interface(`iotop_run',`
gen_require(`
type iotop_t;
attribute_role iotop_roles;
')
iotop_domtrans($1)
roleattribute $2 iotop_roles;
')
########################################
##
## Role access for iotop
##
##
##
## Role allowed access
##
##
##
##
## User domain for the role
##
##
#
interface(`iotop_role',`
gen_require(`
type iotop_t;
attribute_role iotop_roles;
')
roleattribute $1 iotop_roles;
iotop_domtrans($2)
ps_process_pattern($2, iotop_t)
allow $2 iotop_t:process { signull signal sigkill };
')